MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 17


Intelligence 17 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
SHA3-384 hash: b76381f8fccfe2cab0aa83b7ceb87f751e7525146b94abf893543dfe09b203362500df5bf60f508a46114e7f9e290f27
SHA1 hash: 8c412e3a33ac53448d1e3e3c9ec564c4639609d3
MD5 hash: ef3ded086ec0ea9304abfc262de3b482
humanhash: november-oxygen-march-harry
File name:payment_copy.scr.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:1'189'376 bytes
First seen:2025-06-23 14:35:00 UTC
Last seen:2025-07-07 14:26:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:vtb20pkaCqT5TBWgNQ7awynMM5rnd4OHNs6A:sVg5tQ7awy/dC5
Threatray 2'386 similar samples on MalwareBazaar
TLSH T1F045C01373DE8361C3725273BA267741AEBF782506B5F96B2FD8093DE920121521EA73
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter James_inthe_box
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
442
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
payment_copy.scr.exe
Verdict:
No threats detected
Analysis date:
2025-06-23 14:37:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cb4b9d99-5a75-4dbb-9206-233aba8fae07

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10696/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6859676432ed47a3a8d69d61
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context autoit compiled-script exploit explorer fingerprint keylogger lolbin microsoft_visual_cc mpcmdrun packed packed packer_detected pcalua reg
Link:
https://www.filescan.io/uploads/6859664ff8f8abe4f8b7ec6c/reports/6372902b-068a-4574-ae39-814013067ffc/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a98268be-192d-4f72-b800-33d99a446109
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1721026
Signature
Antivirus / Scanner detection for submitted sample
Binary is likely a compiled AutoIt script file
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1721026 Sample: payment_copy.scr.exe Startdate: 23/06/2025 Architecture: WINDOWS Score: 100 26 www.78447223.xyz 2->26 28 www.040512.xyz 2->28 30 20 other IPs or domains 2->30 46 Suricata IDS alerts for network traffic 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 Multi AV Scanner detection for submitted file 2->50 54 4 other signatures 2->54 10 payment_copy.scr.exe 4 2->10         started        signatures3 52 Performs DNS queries to domains with low reputation 28->52 process4 signatures5 56 Binary is likely a compiled AutoIt script file 10->56 58 Writes to foreign memory regions 10->58 60 Maps a DLL or memory area into another process 10->60 62 Switches to a custom stack to bypass stack traces 10->62 13 svchost.exe 10->13         started        process6 signatures7 64 Maps a DLL or memory area into another process 13->64 16 XR74b9GLnujh.exe 13->16 injected process8 process9 18 cleanmgr.exe 13 16->18         started        signatures10 38 Tries to steal Mail credentials (via file / registry access) 18->38 40 Tries to harvest and steal browser information (history, passwords, etc) 18->40 42 Modifies the context of a thread in another process (thread injection) 18->42 44 3 other signatures 18->44 21 CLBSczZEuk0.exe 18->21 injected 24 firefox.exe 18->24         started        process11 dnsIp12 32 sofiadev.tech 144.172.97.86, 49717, 49718, 49719 PONYNETUS United States 21->32 34 stratoconsulting.tech 84.32.84.32, 49697, 49698, 49699 NTT-LT-ASLT Lithuania 21->34 36 10 other IPs or domains 21->36
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/ef3ded086ec0ea9304abfc262de3b482
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-06-20 12:34:06 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vwz2z2et6zq4cv4ognnver2bj6d4kvesfvdwmczchrjlhtnxszeq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
autoit
Create hunting rule
unc_loader_036
Create hunting rule
Similar samples:
38e65102a6d8af117d96ba3159ab096d2b95ea8615408667997ce1375c00f35e
Formbook
5bf3c820c4ed7b2b2e38dec099a4b76273a4e82472ced8f9cad59ba37b02dcb1
Formbook
61d6bc63a0a6db062dd3f42a6ae0dec0a8990d445200660ce6346047128c2cc3
Formbook
8cbf5d97770dedc4bc8ca8cc5cd745900e0524d6d4ecb5db43de5efe87250b75
Formbook
adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
Formbook
error
Formbook
+ 2'376 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250623-rx4abahj4z/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/38b0a8d3-9604-481f-9f0c-c420ef7fdffa
Unpacked files
SH256 hash:
adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
MD5 hash:
ef3ded086ec0ea9304abfc262de3b482
SHA1 hash:
8c412e3a33ac53448d1e3e3c9ec564c4639609d3
Link:
https://www.unpac.me/results/3ac1e112-2301-4806-a411-61103a7bf87f/
SH256 hash:
6d6e400a29e2dc8c6c5ede93e789f9e5ed22cc45ea342fcf6f2f808221a5818f
MD5 hash:
174dc227f18892598264cfc620797acf
SHA1 hash:
a9025d6850ebdc1e4987a25a9ec2799ac464c8fc
Link:
https://www.unpac.me/results/3ac1e112-2301-4806-a411-61103a7bf87f/
SH256 hash:
56f71a8da2d26dde4c2ca15d1b5ff22a39de7f09f2cfc84c6ebad75f26c31577
MD5 hash:
3388116e83535055a06384e1f9d97f96
SHA1 hash:
f749a3329d5628d35665dcaf848aea50025de554
Detections:
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/3ac1e112-2301-4806-a411-61103a7bf87f/
Parent samples :
38e65102a6d8af117d96ba3159ab096d2b95ea8615408667997ce1375c00f35e
5bf3c820c4ed7b2b2e38dec099a4b76273a4e82472ced8f9cad59ba37b02dcb1
61d6bc63a0a6db062dd3f42a6ae0dec0a8990d445200660ce6346047128c2cc3
adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649
adf664c4bba9af7873a7aa41ee0f2264e2757f14d8ac6619194572b58c1e7e68
2fbeb147acc6a400fdf52595966a38c61f6b323536d9a244de11067c9da57610
f0a905542b77b1e9d101dff1115070bffd1871f4c2ada0f3a95ee21081e8c671
3d4b7da0e29cdd7948064dd1a63fe86401240716d54ab1ef4d6e234e0b66807e
4857ee7f02efc4f90333790708097f4ad955beaaf41cdfe6ba11a5385a1ba8d5
2412e0910cc1deae89794bb142f6a0ec6089761fcace1f51f968b8f62bb19c32
34c4a7d2e16716cc0a9f9518718dd8efd2d36f97d2ee93721b9c2b40f4a164ce
cad6df3e9a9ac2d74b5c5276ab7192b8b876cde19259b8a567c80e44362e898f
f10a61792867b7b2d84daa851f8d24169a96cb70b55e09931a7ed2c01853634f
c3c235915752db934ca00b7c30cbcb2b5d83c2a52400ac29ccc1bd66573c534f
ad248905f0468cc57eacd8d3dadd474cd31a8b778c2a0eb952f48bdc525a1ee8
825caca7729cb19432c87c581b6a16240d21f1f3903b81cc98184bd80aa01de2
9ffbfc64827a32593bdcff306f45afaaa69cda089c1b3ed28a8889d17dbf33d0
76692d50ea8233a8ca9d3f9a89890d9a2149f0ff9859476920ed3ffc84c63f64
4caa9777053748e8ee0190b4056f93e1cc6506c212c06c67622c0cf6f476665b
a0cdffded083ccadb44b6b7841cd16580cf4638a573d2684134181dca7462d3a
6a11ab33aa16d2d8ba08cb3c6edb5e0613c1d459287261ecd907f9359068cbc8
b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
affbb0db85505a477fad583411e0361f0502ef4d9c46059da31ca85eb0e0b5d6
261a6e855850526b2697a4065225fee9338f1e2c916f57e60e04516709069141
8c787bab18fce858e66ef04e233ec2e318503e250300628707bc833f23a79194
aa0227c6018d030ef8e31630cd92673ac3d30f7826a49059b4abfc26c77fd486
18af0ba21e4c33129d6a6774af76b2f09cf8ddf9e05fc9917c7b25a6e978e034
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/adb3ace893f6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/adb3ace893f661c1578e335b5247414f87c554922d47660b223c52b3cdb79649

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__GlobalFlags
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10696/

Comments